NPM
Package-lock.json
Deprecated package
Code
Config.yaml
Use explicit value in the api key
paymentGatewayKey: "Fg7H2yLdM8VpQz3N6RbXtPWaK4CsJ9T5"
smsProviderKey: "X1Y2Z3A4B5C6D7E8F9G0H1I2J3K4L5M6"
Logging
Sensitive data is logged
logger.info("user Info" + DB_USER + ", " + API_KEY);
logger.info("Transaction successful: " + from + " sent $" + amount + " to " + to);
processTransaction function on the BE side
e.printStackTrace() this may expose stack traces
no sanitization of the input data
API security
It seems authentication layer only the client side
There is no authentication performed on the API endpoints on the BE side
DB handling:
Use map to store balances then updates them without synchronizing with the database (two transactions run concurrently, a race condition could lead to an inconsistent state)
NPM
Package-lock.json
Deprecated package
Code
Config.yaml
Use explicit value in the api key
paymentGatewayKey: "Fg7H2yLdM8VpQz3N6RbXtPWaK4CsJ9T5"
smsProviderKey: "X1Y2Z3A4B5C6D7E8F9G0H1I2J3K4L5M6"
Logging
Sensitive data is logged
logger.info("user Info" + DB_USER + ", " + API_KEY);
logger.info("Transaction successful: " + from + " sent $" + amount + " to " + to);
processTransaction function on the BE side
e.printStackTrace() this may expose stack traces
no sanitization of the input data
API security
It seems authentication layer only the client side
There is no authentication performed on the API endpoints on the BE side
DB handling:
Use map to store balances then updates them without synchronizing with the database (two transactions run concurrently, a race condition could lead to an inconsistent state)